Portable scope tokens: prove what your agent can do without calling home

Your agent authenticates with an API key. The external service knows who is calling. But it has no idea what the agent is actually allowed to do. This is the gap between authentication and authorization in agent-to-service communication. Auth tokens ...